{"thread":{"id":"56879","subject":"Password for proxies from external","startedAt":"2021-11-12T13:28:55Z","lastAt":"2021-11-12T21:28:25Z","messageCount":2,"participants":["6a50120e@schuerz.at","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"440981","messageId":"5743c211-bf8b-b485-3b81-a71b1b64bb4d@schuerz.at","threadId":"56879","inReplyTo":null,"subject":"Password for proxies from external","fromName":"","fromEmail":"6a50120e@schuerz.at","sentAt":"2021-11-12T13:07:03Z","receivedAt":"2021-11-12T13:28:55Z","isPatch":false,"sender":{"key":"6a50120e@schuerz.at","avatar":null},"body":"Hi there!\n\nIf searched a lot and everywhere i found the same information...\n\nwhen i want to set a http-proxy for git, the configuration goes to \n~/.gitconfig\n\n```\n[http]\n     proxy = http://username:password@proxy.dings.bums:1234\n\n```\n\nSo the proxy password is in cleartext written down to the config-file. \nThe git own password-store can not be used... even no external like pass.\n\n\nFor aliases i can set something like\n```\n[alias]\n     blafoo = \"!f() {do something on shell}; f\"\n```\n\nBut this does not work for proxy-settings.\n\nThere should be a mechanism to read a password or the credentials from \nthe shell in proxy-settings. Something like bash-subshell-construct.\n\n```\n[http]\n     proxy = http://$(pass show key|grep login):$(pass show key|head \n-n1)@proxy.dings.bums:1234\n```\n\nor\n\n```\n[http]\n     proxy = \"!u() {pass show key|grep login}; !p() {pass show key|head \n-n1}; http://u:p@proxy.dings.bums:1234\"\n```\n\nThis would close the security-hole of cleartext-credentials in \nconfig-files...\n\nthank you\n\nJakob\n\n-- \n\n"},{"id":"441001","messageId":"YY7cdTC2HWOoe56z@coredump.intra.peff.net","threadId":"56879","inReplyTo":"5743c211-bf8b-b485-3b81-a71b1b64bb4d@schuerz.at","subject":"Re: Password for proxies from external","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-11-12T21:28:21Z","receivedAt":"2021-11-12T21:28:25Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Nov 12, 2021 at 02:07:03PM +0100, 6a50120e@schuerz.at wrote:\n\n> when i want to set a http-proxy for git, the configuration goes to\n> ~/.gitconfig\n> \n> ```\n> [http]\n>     proxy = http://username:password@proxy.dings.bums:1234\n> \n> ```\n> \n> So the proxy password is in cleartext written down to the config-file. The\n> git own password-store can not be used... even no external like pass.\n\nHave you tried including just the username, like:\n\n  [http]\n  proxy = http://username@example.com:1234\n\nThat should prompt for the password, including using your regular\nconfigured credential helpers; see 372370f167 (http: use credential API\nto handle proxy authentication, 2016-01-26).\n\nWe don't recognize HTTP 407 (\"Proxy Authentication Required\") to trigger\nthe username/password lookup, like we do for an HTTP 401. That probably\nwouldn't be much code to add, but I suspect it's less important for a\nproxy versus a regular site because you only use one proxy (and it\neither needs auth or it doesn't).\n\n-Peff\n"}]}